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Chapter2 


Planning and risk assessment 



Objective and general 
principles of audit planning 
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• ISA 300 Planning an Audit of Financial 
Statements 

• The auditor should plan the audit work so that the 

audit will be performed in an effective manner. 

> Overall audit strategy 

> Audit plan 


• Modern audit approach: risk-based approach umm-mm 

V Identify the main risk areas in the planning stage 

V Base the audit plan around those risks swmmmj 

V Carry out an efficient audit • 

V Reduce the chance of a negligence claim against the 
auditor 
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Planning Process 




> Evaluating compliance with ethical 
requirements 

> Establishing the terms of the engagement 
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Planning activities 


> Developing the audit strategy 

> Developing an audit plan 
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The audit strategy 



KBF 

ts ts it* a 


-:»sitnrei 


review 
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audit approach 
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Planning an audit 
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KNOWLEDGE OF 
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STRATEGY 
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Determines scope and direction of audit 
and determines its development 




Show how the overall strategy will be 
implemented 




RELATIONSHIP BETWEEN STRATEGY AND PLAN 
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Benefits of planning: 

> Attention to important areas 

> Resolve potential problems 

> Select appropriate engagement team members 

> Direct and supervise engagement team members 

> Help coordination of work, such as experts and internal audit 

> Develop an audit strategy: 

S The size of the client 

S The auditor’s familiarity/history with the client 
S The complexity of the audit 
S Any specific reporting requirements 
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The audit strategy KBF 

- A general approach for the nature, timing, and extent of the audit work 

a) Identify the characteristics of the engagement; t mmnwm 

b) Ascertain the reporting objectives to plan the timing of the audit and the 
nature of communication; ,,.... 

c) Consider the significant factors and results of preliminary engagement 
activities that will direct the team’s efforts, and knowledge gained on other 
enagements 

d) Ascertain the nature, timing and extent of resources necessary to perform 

the engagement. _ 


Consideration 
in establishing 
the audit 
strategy 
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The audit strategy 
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• Financial reporting framework 

GAAP or IFRS 

• Special reporting requirements 

Listed companies 
Finance companies 

• Other factors 

Knowledge of the business 

Internal audit function 
Industry reporting 

Computer assisted audit techniques 


•Timetable for reporting- 
Deadlines: 

□Final reporting 
□Any interim report 
□Reports to management 
□Reports to those charged with 
governance 

planning#fg^/^fa 

• Communications with: 

client/audit team/3 rd parties 

• Budgeting 


•Cover the overall approach and 
concern such issues as: 

□Preliminary assessment of 

materiality 

□Preliminary identification of high 
risk areas 

□Results from previous audits 
^Internal control of the client 
□Significant business 
development/changes 
□Significant financial reporting 

changes ias4o wmmmr»mtrim 

□Change in laws and regulations 
□Need for Professional scepticism 
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Audit plan: KBF 

Once the audit strategy has been established, the next step is to develop a 
specific, detailed plan to address how the various matters identified in the 
overall strategy will be applied. 

* S^llword^f Excel 

The auditor will prepare audit planning memorandum. This is a summary 
document given to all member of the audit team prior to the commencement 
of the audit. 
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The audit plan 



The nature, timing and extent of risk assessment 
procedure 
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The nature, timing and extent of further audit procedures; including: 
• what audit procedures are to be carried out Mm 


• who should do them 


• how much work should be done(sample size,etc.) sample 

• when the work should be done( interim or say prefinal vs. final) 



other work should be done 
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Practice 


June 2012 exam Q2(b) 
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2 (a) ISA 300 Planning an Audit of Financial Statements provides guidance to assist auditors in planning an audit. 

Required: 

Explain the benefits of audit planning. (4 marks) 
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ISA 315 Identifying and assessing the risks of material 
misstatement through understanding the entity and its 
environment kob 
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“the objective of the auditor is to identify and assess the risk of material 
misstatement, whether due to fraud or error, at the financial statement 
and assertion levels, through understanding the entity and its 
environment, including the entity’s internal control, thereby providing a 
basis for designing and implementing responses to the assessed 
risks of material misstatement.” 
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SThe auditor must identify the risks of material misstatement and 
use this to guide the design of their audit procedures. 


CREATING GREAT OUTCOMES 








Understanding the entity and its 
environment 
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• ISA 315 Identifying and Assessing the Risks of Material 
Misstatement through Understanding the Entity ^,j 
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• Auditors can gain an initial understanding of a client by: _ 

(i) Latest set of financial statements and performing an 
analytical review of them 

(ii) Meeting with management and internal audit team 

(iii) Searching the internet for articles or reports on the client 

(iv) Requesting permission to meet with the outgoing auditors /or 
to review their audit files 
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Sources of 
Knowledge 
and 

Background 
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Understanding the entity and its environment 
Matter to consider 
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M if Hhfekk^rSff if 


Three aspects: the clients; the clients’ environment; the clients’ 
internal controls 

• The nature of the entity 

-its operations 
—its ownerships 
—types of investments 

—the way it is structured and financed liability fp ownership 

• The entity’s selection and application of accounting policies 

• The entity’s objectives, strategies and related business risks 

• The measurement and review of the entity’s financial performance 

• Relevant industry, regulatory and other external factors 

• The internal controls relevant to the audit 


« : MIMt 
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Assessing the risks of material 
misstatements 


Auditrjsk 

“The risk that the auditor 
expresses an inappropriate 
audit opinion. ” 

jxlPt > 
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Overriding principle(ISA200) 

“To obtain reasonable 
assurance, the auditor shall 
obtain sufficient appropriate 
evidence to reduce audit risk 
to an acceptably low level.” 


2 . mmxmmr 


Will never be eliminated 
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Audit risk 


"The risk of that the auditor 
expresses an inappropricrte 
audit opinion 


RoMM 
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Risk ofrnaterial misstatement 

Financial statements are 
materially misstated prior to audit . 


uvivmiun rf^n 

The procedures performed by 
auditor will not detect a 


misstatement that exists and that 
could be material. 
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A udit risk 
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AUDIT RISK 


IR 


INHERENT RISK 
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X 

L 

_ ) 


CONTROL RISK 





DETECTION RISK 
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CR 


DR 


Risk of material misstatements 
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Audit risk 
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AUDIT RISK 




INHERENT RISK 





3 * 

Depend on the client 

S DR con be manipulated to make the audit risk an acceptable level wwwii 
S If CR and IR are high then DR will be low. The lower the level of DR, 


the greater the level of testing required. 






IfS, ’ XfpjMX 


S To bring the AR down: more work/ qualified member to the team 


rXihjlLTf 
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Materiality, fraud, laws and regulations 
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Misstatement 


^&Fft A 






Misstatement is "a difference between the amount, classification, 


presentation, or disclosure of a reported Financial Statement and the 
amount, classification, presentation, or disclosure that is required for the 
item to be in accordance with the applicable financial reporting framework . 
Mi^aten^nt^njrise fro m e r ro r or fra uid (I SA 450 Eva I u at io n of 
Misstatement identified during the audit) 


Three Categories: 

—factual misstatements 
—judgmental misstatements 
—projected misstatements 


• mMsrmma • • aE7*M • st##asr 

■ #tWBT|b| ■ «P(g+¥Mf3»: • 5M29; ■ 


mi 


ft 




current assets ^XM~^ IFRSAiv>jfL5j]f±M^; 


1/jrt 




CREATING GREAT OUTCOMES 














7 


Materiality, fraud, laws and regulations 


Misstatement 


Three Categories: p p 

—factual misstatements: a misstatement about which there is doubt. 


S£f? 
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—judgmental misstatements: a difference in an accounting estimate that auditor 
considers unreasonable, or the selection or application of accounting policies that the 

.. ... . ° discuss with management > 

auditor considers mappropriatejm^Bm a> °° 

Wfrftfg ■ - ^iA^l=rS ■ ■ #ifffiiAAj-&S - ±M&xrnnB7Wm ■ iattTffljgWB ■ • 


—projected misstatements: a projected is the auditor's best estimate of the total 
misstatement in a population through the projection of misstatement identified in a 
sample. 


jttfgffi • • ]=Wtti+JH**llBSS«Wg)OTEgi! 
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Materiality 
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'Misstatement, including omissions, are considered to be material if they, 
individually or in the aggregate, could reasonably be expected to 
influence the economic decisions of users taken on the basis of the 
financial statement' - ISA 320 




^rif 


Determining materiality is up to the professional judgment of the 
auditor! It is subjective and complex, auditor must consider: 

• Whether the misstatement would affect the economic decision of the 
users; 

• Both size and nature of misstatements 

• The information needs of the users as a group. 
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Materiality 
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Three ways to be used: 

—Material by size (quantity, used to calculate preliminary materiality) 


—Material by nature(quality) 
—Performance materiality 
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Materiality 


Material by size 


General guidance 


• J4-1% of turnover a 


• 5-10% of PBT 


’ itfftHPBT 


•1 - 2% o/ total assets 
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ffl£ : 


7^ i 

AAAA 

' 

i 1 


n O —* £> ^5 


A X 

iv* x ^ ^jg, 



KBF 

m m m 


Material by nature 


’ MftT ’ to some degree, 

material ° 

Misstatement that, when adjusted, 
would turn a profit into a loss 

Misstatement that when adjusted, 
would turn a net-asset to net-liability 

Transaction with directors ) 

Related party transactions] -: u • 


Disclosures relating to possible future 
iegal claims or going concern issues 


-T. |— | 
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Performance Materiality 


P&7 l.vio jnoii t/iduo/ So* 

!>/> fnoctericditjf £v/ 

lo b ->o 2,0 jBfrv 25oh .ftf'lftefi&l 
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'TT ^ @ W'J^ 
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• "The amount set by the auditor at less than materiality for the financial statements 
as a whole to reduce to an appropriate low level the probability that the aggregate of 
unconnected and undetected misstatements exceeds materiality f or the financial 
statements as a whole". 


• 2g*i»7Hf£,e£m+m7.K¥ 

tt«J 5 %- 10 % ■ ttiMHrfg 


- ISA320 


• This reduces the risk that the auditor will fail to identify misstatements that are material when 
added together. 


• The auditor sets performance materiality at a value lower than overall materiality, and uses 
this lower threshold when designing and performing audit procedures 


• 50%-75% of financial statement materiality 
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Materiality, fraud, laws and regulations KBP 


Materiality 


Conclusion: The level of materiality set has a critical impact on the audit in two 
ways: 

• The nature, timing and extent of audit procedures; and • 

• Evaluation of the effect of misstatements, i.e. will the error lead to an 
adjustment or modification of the auditor's report. 
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AUDIT RISK 


INHERENT RISK 
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CONTROL RISK 





DETECTION RISK 
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Risk of material misstatements 
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Inherent Risk 
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Inherent risk is the susceptibility of an assertion about a class of transaction, account balance or 
disclosure to misstatement that could be material, before consideration of any related controls. 




> The risk of a material misstatement in the financial statements because of the nature 

of the industry, entity or the nature of the item itself. •«• fnfmwwp 

> In other words, the risk that a misstatement occurs in the first instance . It is always 


related to business risk. 


* 71 * 1,17 


'H 


Changes in the industry it operates in 
Going concern and liquidity issuesi 


i/;il 


Developing or offering new products • 

IAS 38 IAS 2 

Applicotion of new accounting standards • 

Complex processes • 


Significant accounting estimates ias 38 
High tech industry 

fl ias 2 

Cash based industry 
New accounting standards 
Stock-exchange listing 







Control Risk 
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Control risk is that a misstatement that could occur and that would be material will 

not be prevented, or detected and corrected on a timely basis by the entity’s 
internal control. 

> It could be assessed, but will not be changed by auditor's work. 

> Control risk could be higher either because of the design deficiency or application error. 

SitSWS S**«fl@S**« 

• Lack of authorisation controls 

• Lack of segregation of duties 

• Efficiency internal control policies but staff 
not willing to follow it 


Deficiencies of IT control 

Lack of personnel with appropriate 
accounting skills 

Changes in key personnel including 
departure of key management 


AttSiafSAs 
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Detection Risk 
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Detection risk is the risk that the procedures preformed by the auditor to 
reduce audit risk to an acceptable level will not detect potentially material 

misstatements , either individually or in aggregate, that exist. 


> 

> 


This is only risk auditor can managed 
Detection risk comprises: 

• Sampling risk mm 


7 -« 


□ Sample may not be representative, missed material errors ^ 

□ The auditor’s conclusion based on a sample is different from the conclusion that 
would be reached if the whole population were tested 


• Non-sampling risk: »* 

□ the risk that the auditor’s conclusion is inappropriate for any other reason 
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Detection Risk 


KBF 

♦g ti W g 


• Lack of experiences/ tight budget or deadline 

• Inadequate planning m+'imztm 

• Poor sampling or using inappropriate procedures «»***» 

• A member of the client's staff misleads the auditor 

• Inadequate supervision and review of audit work 


• Inexperience staff 

• First year audit 5*£St;5-^ a ® a7ls ’ 

• Emergence deadline 


Wrong approaches 
Wrong sample 




Relationship between materiality and audit KBF 

1 m M M 

risk 


Inherent 

Risk 

Control 

Risk 

Auditor's Acceptable 
Detection Risk 

Materiality 
(Monetary precision, 

Level of 
substantive 
procedures 

RoMM of the entity’s F/S 


Amount) 


Higher 

Higher 

Lower 

Lower 

Higher 

Lower 

Lower 

Higher 

Higher 

Lower 
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Exam Focus - Audit risk NOT Business risk 
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> Audit risks need to relate to either a risk of material misstatement 
or a detection risk. 

> For risk of material misstatement, identify a balance in the 
scenario that is at risk of misstatement and explain why you 
believe it could be misstated. 

> Detection risks are the risks the auditor does not detect material 
misstatements in the financial statements e.g. when it is a new 
audit client or if there is a tight reporting deadline. 
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Audit risk 

CKoN lAA . c*0> 
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Factor 

Audit Risk 

Business Risk 

Customers are 
struggling to pay 
debts. 

Receivables may be 
overstated if bad debts are 
not written off 

Bad debts may arise 
reducing the profits of the 
company. 

The client 
operates in a fast 
paced industry. 

Inventory may be overstated 
ifthe inventory is obsolete 
and NRV is lower than cost. 

Inventory may have to be 
written off reducing the 
profits of the company. 

Revenue is falling 
due to recession. 

i 

If other factors are present, 
this could mean the company 
is unable to continue to trade 
for the foreseeable future 
and going concern 
disclosures may be reguired. 
CThere is a risk that adeguate 
disclosure is not made. 

Falling revenue will result 
in reduced profits and 
possible going concern 
issues. 
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Practice 
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l.Which of the following amendments to the audit approach would reduce detection risk? 
A Decrease in sample sizes V C- 

B Decrease the materiality level • 

C Decrease supervision • A 


2.Which of the following circumstances gives rise to an inherent risk? *■ 

— 

A The audit client manufactures comp uter equipment 
B Customers are allowed a $100,000 initial credit limit before a formal credit limit is 


agreed following credit ch ecks 




C The finance director has resigned and is yet to be replaced 
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Practice 
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3 Which of the following circumstances would increase c ontrol r isk? 

A The client operates in a highly regulated industry- ^ 

B The auditor is relying on tests of controls and reducing substantive procedures 
accordingly. X 

C There is a high t urnover oif staff in the finance department 

4 Which of the following is an example of an audit risk? - 
A The business is experiencing cash flow problems. v 
B A customer has gone out of business, x 
C A supplier has increased prices • % 

0 Inventory may be overstated due to damaged items being valued at cost instead of 
net realisable value • 
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Practice 
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5 Which of the following is NOT an example of an audit risk? - 

A Intangibles may be overstated due to development costs not meeting the relevant. 
criteria of IAS 38 Intangibles • 

B Disclosures of going concern issues may not be adequate 
C The company may not be compliant with relevant laws and regulations • 

D There is a tight reporting deadline which may mean there are material misstatements 
due to a higher number of estimates included in the financial statements- P ^ 


Right: 1.B 2.A 3.C 4.D 5.C 


CREATING GREAT OUTCOMES 







SyKfliM/pLe 
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Homework 

Question bank: 
P33 Q2 and 
Sep 2016 Q18 
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7.3 The prevention and detection of fraud and KBF 
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Fraud is an intentional act 

involving the use of 
deception to obtain an 
unjust or illegal advantage. 

Fraud has two types: 

• Fraudulent financial reporting: 
deliberately misstatina the accounts 
to make the company better/worse 
than it actually is. 

Error is an unintentional 

misstatement 

• Misappropriation of assets (theft of 
the assets) 


WHAT IS FRAUD 
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RESPONSIBILITY TO FRAUD 




Internal 


Directors: 

The primary responsibility of prevention 
and detection of fraud rests with those 
charged with governance and 
management of an entity. 


Internal auditors: 

May act as a deterrent to fraud. 
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• Implementing an effective 
system of internal 
control; (audit committee) 

• Creating an culture of 
honesty, ethical behavior 
and active oversight by 
those charged with 
governance. 

fllilMfflWfflSSft 
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RESPONSIBILITY TO FRAUD 


Internal 


Directors: 

The primary responsibility of prevention 
and detection of fraud rests with those 
charged with governance and 
management of an entity. 


Internal auditors: 




May act as a deterrent to fraud. 
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• Test the effectiveness of 
internal control. 

• Perform fraud investigation 

• Perform surprise assets 
counts to identify 
missappropriation 
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RESPONSIBILITY TO FRAUD 


However there is unavoidable risk that 



bejdetected even if properly planned in 
accordance with ISAs as the fraud is 
likely to be concealed. 


Report of fraud-timely basis to 
appropriate level of management 

> Those charged with governance; 

> Shareholders 

> Seeking Legal advices 


External auditor: 
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Recogmses that ' ;t 

misstatements in the 
financial statements can 
arise from either fraud and 
error. 


External 

IfllllfElPx ■ ^charged with governance 

■ ffin^nshareholder 

^sJKnPIx^RfElPx ■ seeking legal advices ■ ■ 
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EXTERNAL AUDITOR’S RESPONSIBILITY 
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•Consider any incentives to commit fraud, e.g. profit related bonuses 
•Test year-end journals and adjustments that may be used to manipulate 

by management 

the financial statements 


M iSASfb 


•Make audit procedures unpredictable tt^i+ewT^sau iptwffissifisj&a^x ; * : 

materiality100% ■ PM50% - W+jipSSflSBt&PM ; 

. • r iTAIlJiitJE^IT^Unpredictable 

•Obtain written representation from management that they have 
informed all known or suspected fraud 

•Communicate the fraud matter to management/those charged with 
governance/ report to a party outside the entity as necessary and a 


modified report 




[=1 £n 


i *mm®. 
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Professional scepticism 
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> An attitude that includes a questioning mind, being alert to 
conditions which may indicate possible misstatement due to 
fraud or error, and a critical assessment of audit evidence 

- ISA 200 


> So what can go wrong ? 
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Practice 


juuA,e 3.012. exfliM, 623 (a) 
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3 (a) Explain the external auditors’ responsibilities in relation to the prevention and detection of fraud and error. 

(4 marks) 
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7.4 The auditor's responsibilities to consider laws and |^np 
regulations * ts * « 

•It is the management's responsibility to ensure that the entity's operations are 
conducted in accordance with laws and regulations. This includes responsibilities 
for the prevention and detection of non-compliance with laws and regulations. 

PBT: 1,000 4125% • 

( 250 ) 1IS'z>5]Pi 4 If 15% • 

•Auditor's responsibility differs in relation to types of laws: 

(i) Laws and regulations which have a direct effect on the d etermination of material 
a mou nt s and disc l osu r es in financ i al state ments - obtain sufficient and 
appropriate evidence of compliance, i.e. tax law, financial reporting regulations, 
company law 

(ii) Laws and regulations which do not have a direct effect on the financial statements, 
but may impact the entity's ability to continue trading - specified procedures, i.e. 
environmental legislation, health and safety law, employment law. 
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7.4 The auditor's responsibilities to consider laws and |^np 
regulations * ts * « 

Auditor should take Specified procedures to help identify instances of non- 
compliance that may have a material effect on the financial statements: 

* Understanding the legal and regulatory environment; 

* Inspect correspondence with relevant licensing and regulatory authorities; 

* Enquire of management and those charged with governance 

* Obtain written representation 
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